Monitoring text logs of popular Linux and Unix services

Nobody has time to browse service logs - see how you can use text parsing expressions to track and be alerted about specific events from the text log. To speed up diagnostics, see how you can set up a message description to be added to the alert message.

Please take note that this tutorial was tested on CentOS (64-bit) release 6.5 (Final), Fedora(64-bit) release 18 (Spherical Cow). There may be insignificant differences in other Linux distributions.

Requirements to monitor Linux/Unix services using system/service logs:

1. FTP Server
2. User with system privileges (i.e. SELinux) and access to var/log directory

Create Text Log Expression:

1. Click on Monitoring Text Parsing Expressions Text Log Expressions+Add
2. Enter Name (e.g Login failure Linux)
3. Select Regular Expression Type

4. Provide the followingRegular expression:

   (\w{3}\s{2}\d) (\d{2}:\d{2}:\d{2}) (.*): (.*)$        
   

5. Add Date, Time, Info, and Message variables

6. Provide the following Test Text into Test Text field :

    Jun  3 12:32:29 debian gdm3][3544]: pam_unix(gdm3:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=test
   

Configure Text Log sensor:

1. Click on Network Atlas Nodes
2. Locate the node where FTP server is installed by either the IP Address or the DNS name into search box
3. Right-click on the chosen Node Node Settings
4. Locate Monitoring Sensors section
5. Click on + Add Monitoring Sensor button and add the Text Log sensor
6. Configure the sensor:
   • Select SSHProtocol
   • Select SFTP File Access Type
   • Select the previously created Parsing Expression
   • Select desired Instance Key(e.g. Time)
   • Provide correct Authentication Profile
   • Provide correct file Path (e.g. /var/log/auth.log)

To create Alert on failed authorization:

1. While in the Text Log sensor configuration window click on+ Add Alert New Alert on Text Log Entry
2. Enter Alert Description (e.g. Failed login attempt detected)
3. Select Log entry matching expression option
4. Click on < Add Condition > button

5. Set expression:

   Message contains authentication failure
   

linuxlogtext